The Institute of Internal Auditors presents all things internal audit. In this episode, George Barum talks with Martin Skip Lang Loy about the unique challenges and opportunities of small internal audit functions. They discuss definitions of a small function, advice for starting one, managing expectations, building relationships, and developing future leaders in a small audit environment.
Lang Loy also shares insights on leveraging AI and why emotional intelligence matters as much as technical skills in a small audit environment. Hello, skip. Thanks for joining us today. Today's topic is on small audit functions. I'm really pleased to have you today. Well, thank you so lot, George. Appreciate that. Yeah, absolutely. Look forward to, to hearing your insights on small audit functions, and I have a little experience with, uh, small audit functions as well.
So, uh, look, look forward to, to hearing your thought. Well, George, what would you define as a small audit function? Well, I have worked for a small audit function that is, uh, one to three people. Okay. And I have worked for, what I would say is probably the largest internal audit function that I'm aware of, Walmart. We had over 300 auditors. Okay. So I've seen kind of both ends of the scale.
So, but I guess, uh, for a, um, a definition of small audit function, maybe less than 10, something like that, I guess. Yeah. How would you define it? Yeah, George, you and I are in total agreement on that, less than 10. Uh, like you, I actually started to internal audit departments, which is why we're talking about small internal audit departments, where it was just me.
And what's really interesting is for the external review of our quality assurance improvement program, we did one when I only had two people. Okay. Which was very, uh, interesting. Uh, I don't think they'd ever done one that small before. Yeah. The, I guess the smallest one I worked for, there were two of us, and then we had a, a part-time person. We had an intern. Okay. Occasionally. So, but, um, yeah. So let's get into small audit functions.
Um, maybe first question for you, skip someone who is, is starting a new internal audit function, um, and they know it's gonna be small, they don't have a lot of resources. Um, maybe it is just a, a one person team. What advice would you give to them in, in getting started? What would be some, uh, good practices, good approaches that, that you would try to communicate to them for, for starting a new function? I, I think the first thing you gotta do is you gotta manage expectations.
Because the expectation is that they're gonna, you're gonna be able to do everything that a Walmart internal audit department can do. And, and that's not at all possible. Um, and then the other thing I would say is you've got to have the respect and the, um, what I call mirror authority of, um, of the organization's senior leadership team. So they brought you in for a reason. They said, Hey, we need to have an internal audit function. But you don't want to be internal control eye candy.
You want them to respect you. You want them to value you. And as a result of that, um, at a small audit function, you're gonna be expected to what I would call play in the gray areas. You're not independent. I don't care what anybody tells you. You're not ever gonna be truly independent. And so you just need to make sure that you remain objective and you need to make sure that, uh, you're adding value to the organization.
Because if it's just you and, uh, inevitably you're gonna make somebody mad at you because of something you found, you want them to respect that and not just say, well, this, this individual, we don't want them anymore. That's one of the dangers you run into with a small audit function. But one of the advantages you have with a small audit function is your agility. You're able to, you know, turn on a dime and look at one area, look at another area.
Uh, and then the last thing I would leave you with is find co-sourcing opportunities within the organization. Um, or, you know, have the authority to bring in outside assistance when you need to, um, bring in guest auditors. There's people within the organization that may wanna have a greater appreciation for what the, how the organization operates.
And internal audit offers an ideal opportunity to see everything from, uh, soup to nuts, entire view of the organization, understanding of the risks. And if you can get management to realize that value, and if you can get management to say, Hey, I want my people to understand what's going on in internal audit, then you can leverage that to, to, to, to provide you with the assistance that you need to have to be able to do your job. Yeah.
I think that really speaks to building relationships, establishing credibility, you know, having folks within the organization get to know you, some of your background, some of the things that maybe internal audits could assist with. Could you talk more about that? Could you talk about the relationship side, the credibility side? Just maybe some helpful tips for someone trying to kind of establish themself as they establish the internal audit function as well.
Being in charge of an internal audit function, starting an internal audit function is a different skill set than being an auditor. Uh, you can be the best auditor in the world, but if you can't communicate, um, if you can't make, uh, your, you know, your recommendation's concise, if you can't address it to the audience, uh, then you're not gonna be able to add that value.
And you're going to basically make yourself, you know, somebody that they're not gonna rely on, somebody that they're not gonna respect. Um, so you develop respect by providing a quality product. And what I would say with respect to a, a, a quality product, it's, we all have a tendency as internal auditors to document ourselves to a, an insane degree. And I understand why we need to do that from, you know, if somebody's relying on our work.
But if you're communicating your audit results to management, if you're communicating your audit results to the board, uh, and audit committee, um, you need to address 'em to their audience. You need to address your, your, your findings to that audience. So you need to be concise, you need to be clear, and you don't need to tell them how to build a clock. You just need to tell them what time. It's Okay. Good analogy. Yeah. Kind of an extension of, of, of that.
What about identifying those key stakeholders and, and key folks in the organization to start to have these discussions and start to understand their needs and their expectations? I mean, obviously, uh, if there's an audit committee in place, probably the chair of the audit committee might be a good place to start. But if you think about more the management side, um, who were some key folks in the organization you'd recommend,
uh, having those initial discussions with? Well, On a small audit function, you're probably working for a small company. Obviously the, the, the CEO president is somebody that's gonna be key. Um, you're reporting relationship, you may report administratively to them. And even if you don't report administratively to them, you need to develop a relationship with 'em. You need to schedule, uh, an ongoing meeting with 'em.
It could be initially, you know, once a week, eventually, you know, maybe going to once a month or something like that. Um, CFO and whoever their direct report is, whether it's controller or whatever, um, if you're in a heavily, heavily regulated industry like I am, chief risk officer, chief compliance officer, general counsel, very good relationship with human resources, because the expectation is that eventually you may grow and you need to have that developed, uh, that relationship with them.
And the other thing is, human resources will give you a different perspective on something. They are more in touch with the, uh, emotional, uh, intelligence side of things. We, we don't have a real good emotional intelligence, most of us, because that's the nature of what we do. We don't attract that type of a person.
And so developing a relationship with them, and then, this is gonna sound kind of strange, but developing a relationship with like the executive assistants, the individual that, you know, if you have, uh, restricted access into the building that lets you in in the morning, um, the janitor that you know, that comes in and cleans your office, um, is those are people that you would be surprised at the type of information that you can glean from just having a relationship with them.
Yeah, that's an interesting point. Yeah, I, I agree about the administrative folks. I mean, they, they see everyone coming and going. And, uh, that's always a good person, I think, to, to develop that relationship with. Do you find, skip, that most smaller internal audit functions focus more heavily on financial reporting? Or would you say it's a mix or maybe less so on financial reporting? What, what would you say is a typical, um, you know, focus
of, of effort, uh, for smaller functions? Well, It's gonna depend on the organization, and it's gonna depend on the industry that you're in. And it's also gonna depend on the relationship that you have developed with your external auditors. Um, if you've got a good relationship with the external auditors, and even when I was just a really small, uh, internal audit function, we were doing direct assistance work with them, we realized here's all of the things that they're doing.
I don't need to look at that. Now in the insurance industry, we have something called the model audit rule, which we jokingly refer to as SOX light. And so you should probably involve yourself in that in the SOX review, but you don't want to become just a SOX person. And so I would say, again, depends on the industry, financial industry, you're gonna be spending a little bit more time looking at the financial stuff.
But it's also, as you develop these relationships with people, they're gonna be hopefully at some point saying, Hey, can you come in and help me with this? Can you provide me with some, uh, you know, some, uh, consulting type of arrangement? And, uh, the thing that people get concerned about, and I think that a lot of times, unfortunately, we use this as a crutch. I can't do that. 'cause I'm not into, it will affect my independence.
And I've said this, I don't know how many times we are not independent because we work for the same organization. If the organization, you know, fails, then we're gonna lose a job just like everybody else. But we need to be objective, we need to be, um, you know, we need to have integrity. And you develop that objectivity and you develop that integrity just by the fact of, you know, developing these relationships, uh, within your organization.
But the other thing I would say from a, from a small audit perspective, is you gotta have a network outside of the organization. Um, so join your local chapter of the I i A, if the I I A doesn't have a chapter, then figure out a way to forward one or, you know, see if somebody, uh, some other professional organization has a, uh, local chapter and expand your knowledge outside of just internal audit.
Um, you know, look at ISAC and A CFE, and I'd say those are, they're fairly closely related to what we do, but maybe professional organizations that are, you know, your industry. Um, and if you have an issue with, you know, public speaking, then you know, Toastmasters, go talk to them.
If you've got things within your organization, uh, associate resource groups or, um, you know, something like that, that are bringing in individuals of, you know, um, that, uh, you know, want to discuss the, the issues that they're having, see if you can get involved with one of those.
Uh, you know, in my role, I'm, I'm actually the executive sponsor for the military and first responders associate resource group, uh, because obviously have a background in military, but at the same time, they want somebody with that visibility that, uh, can talk to, you know, senior management about it. And by doing this in a different role, you know, you're not approaching them as an auditor now, now you're approaching 'em as somebody that's trying to help them in, in a specific area.
Uh, again, you develop that, that trust with management, you develop that, Hey, this is somebody that is concerned about the overall welfare of the organization and somebody who we are gonna be able to leverage to help us if we run into something. Yeah. It, it goes back to the relationship side, right? The, the people skills and Absolutely. Yeah. Getting to know folks. So yeah. To totally agree with you there. So skip, uh, next question.
Uh, how, how would you suggest that, uh, a small internal audit function demonstrate the rationale for maybe expanding the function, maybe adding, um, an additional professional to the department? Well, that Goes back to the, the, the value, uh, proposition. If you can demonstrate that you're adding value, then what you can do is you can use that to support the addition of, of an additional staff person. The other thing you can do is do a benchmarking.
Um, there is, you've got peers in the industry and you can say, Hey, you know, this, this company has this many internal auditors. We only have one. You know, and maybe it's something that, uh, you know, we ought to think about doing. Uh, it's getting the, um, audit committee chair on board with it. But it's also not surprising the CFO and CEO, you don't want to go to the audit committee chair and say, Hey, I need additional PE people, and you haven't talked to the CEO or the CFO about it.
If they got on board with it, then you know you're gonna get it. But if they're not on board with it, uh, and you have to convince them of that, that's what you wanna do. 'cause again, you don't wanna put that, you don't wanna damage that relationship that the CFO and the CEO has with your audit committee chair by, you know, holding it out there that you don't think you have enough, enough resources on an annual basis.
The audit committee should be asking you, do you feel like you are adequately, you know, staffed? Do you feel like you have adequate resources and, uh, sufficient budget? And then the last thing I would say is if your organization is growing, then by default you should be growing as well. So if the organization is doubled in size and it's still just one person, um, you know, you gotta say, Hey, you know, we're twice as big as we used to be.
And you know, conceptually that means that we need two people where we only had one before. Right. Great point. Let me change gears just a little bit on you. Skip recruiting and retaining top talent for smaller internal audit functions. Can you say a few words about tips or advice that, uh, for that we need To get away from looking for internal auditors that have an accounting background?
I mean, almost everything we do now has an aspect of information technology, uh, or even more, you know, specific, uh, uh, an aspect of information security. Now what I will tell you is finding, uh, an individual who is well-versed in it and is an auditor is something I call the flying purple unicorn. There's not a lot of them out there. So you may have to have somebody that you bring in, um, and, you know, organically develop that skillset.
But, you know, at the same time, it's looking at the, and this is gonna, you know, it's gonna sound like you're flipping this on its head, but if you bring somebody in straight outta college, they probably already have that skill because of what they, what they've had to do. If you want somebody to have that skill set, you, you may need to think about, I don't want somebody who has experience. I want somebody fresh outta college and bring them in.
Um, and somebody that's got an IT background, somebody that's got a finance background, somebody that may have an HR background, somebody with a fine, uh, you know, a fine arts background, you know, 'cause you can teach anybody how to audit, but you can't teach them to be creative. You can't teach them to be curious. Uh, that has to be something that they, that, that occurs naturally with them. Yeah. Kind of a extension of that, that, uh, answer that you just gave. What about leveraging ai?
I mean, that's something that's a very, you know, popular buzzword and you hear, um, you know, that talked a lot about what about for smaller functions as well? I mean, I would think there would be some opportunities for that, but could you speak about, uh, just Oh, Absolutely. Yeah. We use artificial intelligence. Uh, you gotta be careful though that, uh, you're not using a software or a a, an agent and u and using your p your your private information in that.
So when we develop an audit program, we'll use chat GPT and we'll say, Hey, we want an audit program on workers' compensation claims handling. Um, and the system that they're UE using is a software that we use. And it'll spit something out. And you take a look at that and you say, wow, I never thought of that one. And then you look at this one and you say, well, that one's kind of silly. I don't think we need to look at that.
But it's that keeping as Allison or, uh, Theresa said, keeping the human in the loop looking at what's, what, what's being spit out and saying, Hey, does this make sense? Um, and, but you are using it as a tool and you leverage that tool, um, so that you don't have to have somebody who's, you know, scraping data and, and putting it into an Excel spreadsheet and, and try and determine it. The other way that we use artificial intelligence is in data analytics and getting that data.
And, you know, the, the, we typically would look at 25, I do a sample of 25, and then, you know, impute what that does to the entire population. But you develop credibility with management if you're able to look at the entire population and say, Hey, we found this issue in the entire population and here's what the dollar value or the reputational value is of that issue. That adds a lot of credibility. Skip, You mentioned that, uh, you were in the military. First of all, thanks for your service.
What, uh, what lessons or the experience that you had in the military would you say you're able to bring forward and implement that in internal audits and, and advice that you would give a small internal audit function? That's a really good question, George.
And, and what I would say is when you're in the military, you are given an opportunity to exhibit or to engage in leadership at a very young point in your career, I was a commanding officer of a patrol boat, uh, 82 foot patrol boat in Newport Beach, California. When I was 30 years old. I got an opportunity to do that again, uh, for 110 foot patrol boat in Seward, Alaska.
But when I first graduated from the Coast Guard Academy, I was put in charge of a department, and the expectation was, is that, um, you know, I was gonna lead that department and, you know, if something happened that I was gonna be able to step up and, and go up to a, to, to a larger role within the, within the organization. So it's that opportunity to get the leadership at an early point in your career that has really served me well.
And I learned a couple of hard lessons, uh, while I was in the military. Um, one of the first ones was hubris. Um, I, uh, developed that, you know, you're in a position, you're in charge of this ship, and oh my God, you know, you feel like you're walking on water and, you know, reality hits you in the face and you realize, you know, you're not, you're not performing to the level that you're, uh, that you're boss expects you to.
Um, and so that's a hard lesson to learn, but you learn it early in your career. Um, and, you know, that's, that's what's very beneficial. So how do you equate, how do you do something like that to somebody that doesn't have that military experience?
And it goes back to the, the, the development aspect of, you know, your staff and as getting them involved in things where they are able to exercise their nacient leadership capabilities in a very low threat environment, get 'em involved with a local chapter, the I i a or some other professional organization, if that's not available, see if there's some sort of a group within the company itself, uh, that they can get involved with.
And if that's not available, tell 'em, you know, join a homeowner's association. If you got a house somewhere, um, get on the board of your church. Get on the board of your synagogue, get on the board of something. Um, and that way, you know, as a volunteer, you can develop those skills and, uh, those will serve you very well in the future. Right. Okay. Skip, that's all I have for you today. Thank you so much. Really appreciate your time. Oh, you're welcome. Awesome. Nice talking to you.
And I, I really enjoyed this. Thank you very much. Small internal audit teams boost your efficiency at the 2025 audit sphere. This one day virtual conference on June 17th offers expert strategies and practical tools just for you. Register now@theiia.org. If you like this podcast, please subscribe and rate us. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or@theiiaa.org. That's THE IIA a.org.